Pachno 1.0.6 is vulnerable to a stored cross‑site scripting flaw. Attackers can embed malicious HTML or JavaScript payloads in several POST parameters—value, comment_body, article_content, description, and message. These inputs are persisted to the database without proper sanitization when retrieved via Request::getRawParameter() or Request::getParameter() calls. Whenever a page renders these fields, the unsanitized content is executed in the victim's browser, enabling the attacker to run arbitrary client‑side scripts. This can lead to session hijacking, defacement, or data theft, impacting confidentiality, integrity, and availability for all users that view the affected content.

Pachno 1.0.6, provided by the vendor Pachno.

The CVSS score of 5.1 indicates a medium severity. Although EPSS and KEV information are not available, the stored nature of the flaw suggests that exploitation requires write access to the application, typically through an authenticated user, but the resulting script runs in any recipient’s browser. Given the lack of mitigation on the server side, this vulnerability is reasonably straightforward to exploit for attackers who can submit data, with the potential for widespread impact on users. Security teams should treat it as a priority to patch.